Technical Specialist for Development and Delivery - XSIAM

Our Mission

At Palo Alto Networks®, we’re united by a shared mission—to protect our digital way of life. We thrive at the intersection of innovation and impact, solving real-world problems with cutting-edge technology and bold thinking. Here, everyone has a voice, and every idea counts. If you’re ready to do the most meaningful work of your career alongside people who are just as passionate as you are, you’re in the right place.

Who We Are

In order to be the cybersecurity partner of choice, we must trailblaze the path and shape the future of our industry. This is something our employees work at each day and is defined by our values: Disruption, Collaboration, Execution, Integrity, and Inclusion. We weave AI into the fabric of everything we do and use it to augment the impact every individual can have. If you are passionate about solving real-world problems and ideating beside the best and the brightest, we invite you to join us!

We believe collaboration thrives in person. That’s why most of our teams work from the office full time, with flexibility when it’s needed. This model supports real-time problem-solving, stronger relationships, and the kind of precision that drives great outcomes.

Job Summary

Job Summary 

Palo Alto Networks is seeking an experienced Cortex XSIAM practitioner and instructor to architect, develop, and deliver advanced learning for the Advanced XSIAM Bootcamp. In this role, you will work cross-functionally across the different teams within enablement and professional services. You will own the end-to-end lab experience for a two-week, intensive program designed to prepare partners and Professional Services engineers for field deployments. You will partner with Technical Services Practice Architects to design, validate, deliver, and continuously maintain Advanced XSIAM Bootcamp content aligned with current product capabilities and field delivery practices. 

You will leverage deep practitioner-level knowledge of cybersecurity technologies and complex infrastructure—standing up multi-cloud lab environments, facilitating live technical tracks across SIEM/Endpoint and Automation, troubleshooting environments in real time, and evaluating student performance. By validating content, automating lab provisioning, and resolving issues independently, you will ensure a seamless learning experience and shape the readiness of future cybersecurity professionals.

Key Responsibilities

• Lab Infrastructure & Automation: Stand up, configure, and maintain multi-tenant GCP and Cortex XSIAM environments for concurrent instructional tracks. Automate environment provisioning, tenant resets, and teardowns using Terraform, gcloud, and custom scripts to eliminate reliance on external DevOps teams.
• Environment Validation: Perform end-to-end validation of all lab guides and exercises before Day 1. Resolve underlying defects (networking, IAM permissions, credentials, placeholder values) to ensure students can execute exercises without instructor intervention.
• Technical Development Instruction & Delivery: Architect, develop, and deliver four-day intensive lab tracks covering Automation, SIEM, and related domains both virtually and in person. Guide students through complex configurations including Broker VM clustering, Cloud Identity Engine, custom XQL parsing/data modeling, indicator mapping, playbook debugging, and agentic AI.
• Student Enablement & Support: Maintain cohort progress via scheduled check-ins, live remote-control troubleshooting, and clear explanations of internal platform mechanics (correlation latency, role constraints, hidden table fields). Distinguish between product defects and student error for timely escalation.
• Evaluation & Readiness Reporting: Score end-of-course assessments, develop capstone projects against established rubrics, and deliver detailed per-student readiness recommendations to leadership. 
• Continuous Improvement: Track and log environment/content issues per cohort, update master lab guides with live session corrections, build remedial training tied to gaps and readiness, and decommission cloud assets promptly to optimize spending.

Qualifications

• Required Qualifications
  • 5+ years of hands-on experience as a Cortex practitioner in a Professional Services, MSSP, or Customer Engineering role, with deep domain knowledge of enterprise technologies and infrastructure.
  • Deep expertise in XSIAM technical tracks: data onboarding (Broker VM, syslog/CEF, NGFW, GCP), XQL, parsing rules, correlation logic, playbook development, classifiers/mappers, and agentic AI features.
  • Strong technical proficiency in Google Cloud Platform (Compute Engine, IAM, VPC, Cloud Storage) alongside PAN-OS NGFW, Active Directory, Windows Server, and Linux administration.
  • Demonstrated experience writing automation scripts using Python, PowerShell, Bash, and Terraform for repeatable lab builds and environment resets.
  • Proven background in technical instruction, training, or facilitation for senior engineering audiences, including live troubleshooting in a classroom setting.
  • Excellent written communication skills for creating lab guides, maintaining issue logs, and delivering clear student evaluation reports.
  • Based primarily in Santa Clara, CA or Plano, TX, with the ability to travel up to 50% for on-site bootcamp cohorts as needed.
    
• Preferred Qualifications
  • Active Cortex certifications (Cortex XSIAM Engineer/Analyst, Cortex XSOAR Engineer) or Palo Alto Networks certifications (PCNSE, PCNSA).
  • Hands-on experience with lab orchestration platforms (e.g., Torque), lab image management, or observability pipelines like Cribl.
  • Experience instructing engineers transitioning from competitive SIEM platforms (Splunk, Securonix) and mapping legacy concepts to XSIAM architecture.
  • Background in writing technical assessments, rubrics, and grading criteria.
  • Familiarity using generative AI tools for instructional content development and rapid troubleshooting.

Qualifications

Our Commitment

We’re trailblazers that dream big, take risks, and challenge cybersecurity’s status quo. It’s simple: we can’t accomplish our mission without diverse teams innovating, together.

We are committed to providing reasonable accommodations for all qualified individuals with a disability. If you require assistance or accommodation due to a disability or special need, please contact us at [email protected].

Palo Alto Networks is an equal opportunity employer. We celebrate diversity in our workplace, and all qualified applicants will receive consideration for employment without regard to age, ancestry, color, family or medical care leave, gender identity or expression, genetic information, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, or other legally protected characteristics.

All your information will be kept confidential according to EEO guidelines.